Merge pull request #476 from PixlOne/fix-cve-2024-45752

Fix CVE-2024-45752
2025-09-14 13:56:50 +08:00 · 2024-09-27 20:46:28 -04:00 · 2024-09-27 20:43:01 -04:00
1 changed files with 4 additions and 3 deletions
--- a/src/logid/logiops-dbus.conf.in
+++ b/src/logid/logiops-dbus.conf.in
@ -3,11 +3,12 @@
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">

 <busconfig>
-  <policy user="root">
-    <allow own="pizza.pixl.LogiOps"/>
+  <policy context="default">
+    <deny receive_sender="pizza.pixl.LogiOps"/>
  </policy>

-  <policy context="default">
+  <policy user="root">
+    <allow own="pizza.pixl.LogiOps"/>
    <allow send_destination="pizza.pixl.LogiOps"/>
    <allow receive_sender="pizza.pixl.LogiOps"/>
  </policy>
Author	SHA1	Message	Date
pixl	628ab937a2	Merge pull request #476 from PixlOne/fix-cve-2024-45752 Fix CVE-2024-45752	2024-09-27 20:46:28 -04:00
pixl	9495516e0c	Fix CVE-2024-45752 Prevents arbitrary users from accessing d-bus interface. Fixes #473. This change now requires any application using the LogiOps D-Bus interface to run as root.	2024-09-27 20:43:01 -04:00